mirror of
https://gitlab.com/shorewall/code.git
synced 2024-11-14 11:44:01 +01:00
b66929a65e
1) Elimination of the "shorewall monitor" command. 2) The /etc/shorewall/ipsec and /etc/shorewall/zones file are combined into a single /etc/shorewall/zones file. This is done in an upwardly-compatible way so that current users can continue to use their existing files. 3) Support has been added for the arp_ignore interface option. 4) DROPINVALID has been removed from shorewall.conf. Behavior is as if DROPINVALID=No was specified. 5) The 'nobogons' option and BOGON_LOG_LEVEL are removed. 6) Error and warning messages have been made easier to spot by using capitalization (e.g., ERROR: and WARNING:). 7) The /etc/shorewall/policy file now contains a new connection policy and a policy for ESTABLISHED packets. Useful for users of snort-inline who want to pass all packets to the QUEUE target. 8) A new 'critical' option has been added to /etc/shorewall/routestopped. Shorewall insures communication between the firewall and 'critical' hosts throughout start, restart, stop and clear. Useful for diskless firewall's with NFS-mounted file systems, LDAP servers, Crossbow, etc. 9) Macros. Macros are very similar to actions but are easier to use, allow parameter substitution and are more efficient. Almost all of the standard actions have been converted to macros in the EXPERIMENTAL branch. 10) The default value of ADD_IP_ALIASES in shorewall.conf is changed to No. 11) If you have 'make' installed on your firewall, then when you use the '-f' option to 'shorewall start' (as happens when you reboot), if your /etc/shorewall/ directory contains files that were modified after Shorewall was last restarted then Shorewall is started using the config files rather than using the saved configuration. git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2409 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
61 lines
2.2 KiB
Plaintext
61 lines
2.2 KiB
Plaintext
##############################################################################
|
|
#
|
|
# Shorewall 2.6 -- Hosts Accessible when the Firewall is Stopped
|
|
#
|
|
# /etc/shorewall/routestopped
|
|
#
|
|
# This file is used to define the hosts that are accessible when the
|
|
# firewall is stopped or when it is in the process of being
|
|
# [re]started.
|
|
#
|
|
# Columns must be separated by white space and are:
|
|
#
|
|
# INTERFACE - Interface through which host(s) communicate with
|
|
# the firewall
|
|
# HOST(S) - (Optional) Comma-separated list of IP/subnet
|
|
# addresses. If your kernel and iptables include
|
|
# iprange match support, IP address ranges are also
|
|
# allowed.
|
|
#
|
|
# If left empty or supplied as "-",
|
|
# 0.0.0.0/0 is assumed.
|
|
# OPTIONS - (Optional) A comma-separated list of
|
|
# options. The currently-supported options are:
|
|
#
|
|
# routeback - Set up a rule to ACCEPT traffic from
|
|
# these hosts back to themselves.
|
|
#
|
|
# source - Allow traffic from these hosts to ANY
|
|
# destination. Without this option or the 'dest'
|
|
# option, only traffic from this host to other
|
|
# listed hosts (and the firewall) is allowed. If
|
|
# 'source' is specified then 'routeback' is redundent.
|
|
#
|
|
# dest - Allow traffic to these hosts from ANY
|
|
# source. Without this option or the 'source'
|
|
# option, only traffic from this host to other
|
|
# listed hosts (and the firewall) is allowed. If
|
|
# 'dest' is specified then 'routeback' is redundent.
|
|
#
|
|
# critical - Allow traffic between the firewall and
|
|
# these hosts throughout '[re]start', 'stop' and
|
|
# 'clear'. Specifying 'critical' on one or more
|
|
# entries will cause your firewall to be "totally
|
|
# open" for a brief window during each of those
|
|
# operations.
|
|
#
|
|
# Example:
|
|
#
|
|
# INTERFACE HOST(S) OPTIONS
|
|
# eth2 192.168.1.0/24
|
|
# eth0 192.0.2.44
|
|
# br0 - routeback
|
|
# eth3 - source
|
|
#
|
|
# See http://shorewall.net/Documentation.htm#Routestopped and
|
|
# http://shorewall.net/starting_and_stopping_shorewall.htm for additional
|
|
# information.
|
|
##############################################################################
|
|
#INTERFACE HOST(S) OPTIONS
|
|
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
|